Information leak in Paint in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (CVE-2026-78895)

CVE-2026-78895 describes an information leak vulnerability in the Paint component of Google Chrome before version 152.0.7977.65. The vulnerability enables a remote attacker to bypass the web origin policy via a specially crafted HTML page. This could lead to unauthorized disclosure of information. The issue is classified under CWE-200 (Exposure of Sensitive Information). The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality impact.

The vulnerability allows an attacker to bypass the web origin policy, potentially exposing sensitive information from the browser's Paint component to a remote attacker. The impact is limited to confidentiality loss without integrity or availability effects. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users and administrators should monitor official Google Chrome security advisories for updates and apply the update to version 152.0.7977.65 or later once available.